> ## Documentation Index
> Fetch the complete documentation index at: https://altostrat.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Managed Remote Desktop

> Understand organization-enrolled computers, device readiness, enrollment profiles, consent, and the current availability of managed remote sessions.

Managed Remote Desktop connects an organization-enrolled computer to the existing **Hosts** workspace. The computer runs **Altostrat Remote Agent**; Studio uses **Altostrat Remote Viewer** for the session. Operators find the device under its customer or site folder and review access before requesting a view.

<Note>
  Managed Remote Desktop is available only in enabled deployments. Enrollment and inventory can be available before live viewing. Windows remote control and the macOS viewing/control rollout remain in development, and managed Remote Desktop tools are not yet available to Copilot. Confirm the capabilities enabled for your organization with your administrator before planning a support session.
</Note>

## Choose the right remote feature

| Feature | What it does | How access starts |
| - | - | - |
| Managed Remote Desktop | Access an enrolled endpoint through organization policy and device readiness. | **Connect remotely**, then review and **Request view**. |
| [Windows RDP](./remote-desktop) | Open a Windows RDP session using a host protocol and its credential. | Choose the host's RDP protocol. |
| [Studio Remote](./studio-remote) | Continue Studio conversations and handle supported approvals from a mobile device. | Pair the mobile companion with a running Studio desktop. |

A host can have both an enrolled Remote Agent and existing SSH, RDP, or web protocols. Managed access uses the enrolled device identity; it does not require a permanent remote-access password in Key Chain. The device's **support code** is an identifier, never permission to connect.

## Before a session

You need an enabled Studio desktop build, access to the host in the selected organization, a compatible enrolled agent, and a device whose desktop is ready. Web administration can manage devices and profiles; viewing requires the desktop viewer.

The current endpoint package scope is Windows 10/11 x64 and Apple silicon Macs. Windows ARM64, Windows Server/RDS, Intel Macs, Linux, and mobile endpoints are outside that scope. A package or an Online badge does not establish that viewing or control is available on that endpoint.

On macOS, the endpoint needs Screen Recording permission to capture the desktop. Control also requires the applicable Accessibility permission. Use the agent's permission status, **Open Settings**, and **Recheck** guidance. Installing the package does not silently grant Screen Recording, and pre-login/FileVault desktop access is unsupported.

## Inspect a managed device

Open the host's **Device Details** before connecting. Check the customer/site placement, device identity, agent version, and the timestamps beside its health information.

| State | What it tells you |
| - | - |
| Management | Whether the device is managed, enrolling, revoked, or quarantined. |
| Presence and Last seen | Whether the agent has recently contacted the service. |
| Desktop readiness | Whether an active console, capture, input, and any required approval interface are available. |
| Compatibility | Whether the agent and viewer support the required session contract. |
| Inventory freshness | How recently the hardware and operating-system snapshot was captured. |
| Effective policy | Whether access requires approval, permits unattended access, or is disabled, and where that rule comes from. |

**Online is not the same as ready.** A computer can report healthy heartbeats while locked, without an active user, or without capture permission. Inventory can remain Fresh while the computer is Offline. Inventory older than 24 hours is marked Stale; use its capture time when assessing the values.

Detected OS, CPU, memory, disks, displays, and other reported inventory are read-only. They are separate from the names and device labels you edit in the host record.

## Request a view

In an enabled deployment, viewing follows the device's effective policy. First pass the access, readiness, compatibility, and policy preflight; then request the view. This flow stops at **View**; control has a separate capability and authorization path.

```mermaid theme={null}
flowchart LR
    accTitle: Managed remote viewing and endpoint consent
    accDescr: After passing preflight, the operator requests a view. If local approval is required, the endpoint user must allow the request. An authorized unattended policy can omit that prompt. Denial or timeout does not start a view.
    Request[Request view<br/>Preflight passed]
    Request --> Policy{Local<br/>approval?}
    Policy -->|Yes| Local[Endpoint user<br/>reviews request]
    Policy -->|No: unattended allowed| View[View session]
    Local -->|Allow| View
    Local -->|Deny or timeout| Stop[No view session]
```

<Steps>
  <Step title="Choose the host explicitly">
    Confirm the organization and customer/site folder, then select **Connect remotely**. Selecting a host or search result does not start a managed session.
  </Step>

  <Step title="Review the preflight">
    Check the exact endpoint, readiness, effective policy and its source, and whether someone at the computer must approve. The request starts with **View**; it does not grant control.
  </Step>

  <Step title="Select Request view">
    If the action is unavailable, follow the displayed reason. A missing viewer, disabled deployment, revoked device, or unavailable console requires its own remedy.
  </Step>

  <Step title="Wait for the required local approval">
    Under approval-required policy, the person at the endpoint must allow the request. A denial or timeout does not authorize another route into the desktop.
  </Step>

  <Step title="End the session when finished">
    Use **Disconnect** and check that the viewer reports the ended state. Switching tabs is not a disconnect.
  </Step>
</Steps>

The viewer shows actions supported by the current session. Background or unfocused managed viewers do not forward input. **Escape** releases local input capture; it does not end the session.

### View and Control are separate

Viewing does not authorize clicks or typing. Where Control is enabled in a supported deployment, **Request control** requires a role that permits control, a ready input capability, and separate authorization. Approval-required policy also requires a fresh local approval for that scope. **Release control** gives up input; **Disconnect** ends the session.

Windows input/control is still being completed. Do not treat a visible Control action, a profile setting, or an unattended policy as a guarantee that control works. Lock, sign-in, UAC, and user-switch behavior must follow the endpoint's reported supported capabilities.

## Consent and folder policy

The service evaluates the organization default and the nearest explicit folder override for the device's current placement.

| Policy | Result |
| - | - |
| Approval required | A local user must approve the requested scope. |
| Unattended allowed | Policy may permit a session without a local prompt; role, host access, readiness, and session authorization still apply. |
| Disabled | Managed sessions are blocked. |
| Inherit, on a folder | Use the nearest ancestor override or organization default. |

Administrators manage these rules. Before changing a folder to unattended or disabled, review the affected devices, inheriting folders, explicit overrides, and the stated effect on active sessions. Moving a host can change the policy that applies to it without re-enrollment.

An unassigned device or unresolved policy is not a shortcut to unattended access. Resolve placement or policy with an administrator before connecting.

## Enroll one device or a fleet

Organization administrators use **Administration → Remote Desktop**. The workspace has **Overview**, **Deployment**, **Devices**, and **Activity** sections.

In an enabled deployment:

1. Open **Deployment → Create enrollment profile**.
2. Choose **One device** or **Fleet**, and give the profile a recognizable name.
3. Choose the customer/site folder, or leave the devices **Unassigned** for later placement.
4. Set the intended platform, architecture, update channel, expiry, and maximum uses. Use only platform/architecture combinations for which your administrator supplies an approved package.
5. Create the profile and securely save its enrollment secret while it is displayed.
6. Deliver the approved Altostrat Remote Agent package and enrollment material through your organization's installation or RMM/MDM process.
7. Review profile progress and **Show enrolled devices**, then inspect each device's placement and readiness.

<Warning>
  The enrollment secret is shown once and cannot be retrieved from the profile catalog after dismissal. A fleet secret can enroll multiple devices within its configured limits; “shown once” does not mean “usable once.” Keep it out of chat, host fields, screenshots, and golden images. If it is lost or exposed, revoke the profile and issue a replacement.
</Warning>

Profiles and package delivery are separate. An available profile does not mean a signed installer is available from that screen, and selecting an update channel does not establish automatic fleet updates. Use the package and update process supplied for your deployment.

Revoking a profile stops new enrollment through that profile. To remove an already enrolled computer's access, revoke the **device** separately.

### Unassigned and quarantined devices

Use **Devices** to review Unassigned and Quarantined devices. An administrator can assign or relink a device to the appropriate host and folder. Placement does not repair a quarantined identity.

Prepare golden images before device identity is generated. Cloning an already enrolled machine can create an identity conflict that requires administrator recovery. Repeated enrollment attempts or moving the record into another folder do not resolve that conflict.

Device administration also includes credential rotation and revocation where enabled. Review the confirmation and completion state; revocation, profile revocation, and deleting a host record have different effects. Retained inventory and activity can remain after access is revoked.

## Activity and troubleshooting

**Activity** records remote-session lifecycle facts: operator, device, request and consent outcome, policy, timing, connection path, and safe failure reason. The operator view covers the last 90 days. It is separate from Terminal History and does not record screen contents, typed text, or clipboard contents.

Open an event or session to inspect its timeline and copy the redacted support summary. Include the diagnostic ID, time, platform, and agent/Studio versions when asking for help.

| Symptom | Next step |
| - | - |
| Connect remotely is missing or unavailable | Confirm host access and that your organization and desktop build have managed sessions enabled. |
| Online, but Request view is blocked | Inspect active-console, capture, approval, and compatibility readiness. |
| Device is Unassigned | Ask an administrator to place it under the correct host/customer folder. |
| Device is Quarantined | Ask an administrator to resolve the identity conflict; folder placement alone is insufficient. |
| Request is awaiting approval | Have the endpoint user review the exact request; respect Deny or timeout. |
| View works but Control is unavailable | Check role, input readiness, and the current Control rollout. |
| Sessions are paused by Altostrat | Contact the organization administrator. Hosts, inventory, Activity, and separately configured RDP can remain available. |
| Enrollment profile is expired, exhausted, or revoked | Ask an administrator for a new bounded profile. |
| Agent reports a clock or version problem | Correct that condition and recheck readiness before requesting a new session. |
| Session fails or remains uncertain after Disconnect | Review Activity and the endpoint's local session state; give support the redacted diagnostic ID. |

## Current limits

Managed Remote Desktop does not provide file transfer, clipboard synchronization, remote shell, audio, session recording, or hidden access. Use separately authorized Studio protocols and tools for those jobs.

Copilot's existing Windows RDP tools apply to [RDP sessions](./remote-desktop). Local Computer Use applies to the workstation running Studio. Neither is a substitute for the unavailable managed Remote Desktop AI workflow.

## Related

<CardGroup cols={2}>
  <Card title="Hosts and credentials" icon="server" href="./hosts-and-credentials" arrow="true" cta="Organize endpoints">
    Keep customer folders, host protocols, credentials, and detected inventory distinct.
  </Card>

  <Card title="Organization administration" icon="building" href="./organization-administration" arrow="true" cta="Manage access">
    Review organization roles, access, and administrative responsibilities.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.